CVE-2026-54411
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path, allowing a local or network-adjacent attacker to recover the plaintext password of a target account by measuring response-timing differences.
Risk Assessment
An attacker can recover user passwords, leading to data confidentiality breach and unauthorized access to systems.
Recommendation
Update Linux-PAM to a version newer than 1.7.2. Restrict access to authentication services to trusted networks.
Other vulnerabilities in Linux-PAM
See all- CVE-2024-22365Medium
A vulnerability in Linux PAM before version 1.6.0 allows attackers to cause a denial of service by blocking the login process. The issue stems from the lack of the O_DIRECTORY flag in the openat call for the protect_dir function, enabling the use of mkfifo.
- CVE-2025-6020High
A vulnerability was found in the pam_namespace module of linux-pam, where user-controlled paths are not properly protected. A local attacker can exploit symlink attacks and race conditions to escalate privileges to root.
Original NVD description (English source)
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.